Re: issue 45 - clarifications to security considerations

[email protected] wrote:

>This sounds redundant to me:
>  
>
Ok, lets not add anything here then.

>>Add the following text to the end of this paragraph:
>>
>>  ... Such an attack could also be defeated by use of
>>  negative acknowledgements, such as TCP RST and ICMP
>>  errors. However, too eager reliance on such acknowledgements
>>  has some denial-of-service issues itself. Also, many networks
>>  filter ICMP messages, and in our case the lack of a valid SA
>>  in the victim prevents TCP processing of incoming ESP packets.
>>    
>>
>
>No, this is misleading: the victim sees only a bunch of ESP
>packets it cannot decrypt, and it doesn't even know who
>the real sender (e.g., TCP endpoint) is. And if you don't know 
>that, where do you send the TCP RSTs or other negative acks?
>  
>
Here's another attempt:

  Such an attack could also be defeated by use of
  negative acknowledgements, such as TCP RST and ICMP
  errors. However, in our case the victim lacks a valid SA
  and, as a result, is incapable providing any other
  negative acknowledgements than ICMP errors. Such
  errors may be filtered in many networks, and has
  some denial-of-service issues itself.